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FIG. 2 



Contents stored in 
memory 120 



Data block including 
decryption information 
211, and non-encrypted 
execution block 221. 



Data block including 
decryption information 
212, and encrypted 
execution block 222. 



Data block including 
decryption information 
213, and non-encrypted 
execution block 223. 



Data block including 
decryption information 
214, and encrypted 
execution block 224. 



Data block including 

decryption information 
215, and non-encrypted 
execution block 225. 



(Address) 
0x000000 

-^201 

0x111110 
0x111111 

■^202 

0x222221 
0x222222 

-^203 

0x333332 
0x333333 

-^204 

0x444443 
0x444444 

■^205 
OxFFFFFF 
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FIG. 3 



Data block 201 (~205) 



Decryption 
information 

211(~215) 



211b 
(~215b) 

211a 
('-'215a) 



Execution 
block 

221 ('-'225) 



221a 
(~225a) 



230- 



Encryption presence/ 
absence information 
(16 bits) 



Key data for next 
data block 202 
(through 205) 

(64 bits) 



Instruction codes 



Execution 
completion code 



(Offset) 

0x00 

0x01 

0x02 



0x09 
OxOA 



n-2 
n-1 
n 
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FIG. 4 



( Start ) 









Single program is divided into five 
instruction-code groups 221a through 225a. 


^SlOl 




f 




Key data 210a through 215a for data blocks 
201 through 205 is determined. 


^S102 


N 






Decryption information 211 through 215 for 
data blocks 201 through 205 is prepared. 


^S103 





Execution completion code 230 is added to 
instruction-code groups 221a through 225a to 

generate execution blocks 221 through 225. 
Data blocks 201 through 205 are prepared from 
execution blocks 221 through 225 and decryption 
information 211 through 215. 





All decryption information 211 through 215 is 

encrypted with key data 210a through 214a, 
while among execution blocks 221 through 225, 
to-be-protected execution blocks 222 and 224 

are encrypted with key data 211a and 213a. 



S105 



Prepared data blocks 201 through 
205 are stored in memory 120. 



S106 



( Exit ) 
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FIG. 5 



Start ^ 



Key-data temporary retention portion 106a and 
selection-command temporary retention portion 
106b in decryption-data management portion 106 
retain first key data and selection command. 



•S201 
/S202 



CPU 101 puts decryption-information read signal to H level. 
Decryption-information management portion 106 sets key data 
and selection command, retained in key-data temporary 
retention portion 106a and selection-command temporary 
retention portion 106b, in key-data retention portion 103 
and selection-command retention portion 105. Selection 
portion 104 switches so as to select output from decryption 
portion 102, 



NJ^ 

CPU 101 outputs stored address for decryption 



Memory 120 outputs the decryption 
information. 



8203 



Decryption portion 102 decrypts decryption information 
outputted from memory 120, using key data set. in key-data 
retention portion 103. Selection portion 104 selects and 
input this into CPU 101. 



CPU 101 outputs key data and selection command in 
accordance with decryption information so as to make key- 
data temporary retention portion 106a and selection-command 

temporary retention portion 106b in decryption-data 
management portion 106 retain those. 



S204 



S205 



CPU 101 puts decryption-information read signal to L level. 
Selection portion 104 switches so as to select output from 
either memory 120 or decryption portion 102 according to 
selection command set in selection-command retention 
portion 105. 



S206 



CPU 101 outputs stored address for instruction code 
included in execution block, and reads the non-encrypted 
instruction code outputted from memory 120, or the 
instruction code decrypted by decryption 
portion 102. • 



8207 



S208 



8209 




Yes 



CPU 101 executes the instruction 
of instruction code. 
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FIG. 7 



Contents retained in key table 306a 



Key number 


Key data 


Selection 
command 


0x01 


Oxlllllllll"- 
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0x02 


0x222222222- •• 
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0x03 


0x333333333•■• 
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0 


0x00 
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FIG. 8 



Data block 401 (~407) 



421 
■-427) 

431 
^437) 



Key 
informa- 
tion 
441 
(—447) 



Decryption 
information J 
411 ^ 
(-417) 



441 
■-447) 



441a 
-447a)'- 



Key data for data 
441b block 402 

'447b) 4 

(64bits) 

441c L— - 

'AA7r)\ Encryptioji preser 
•±•±1*^/ V. absenc|g^Dfojmat 

441a 
--447a)" 



441b 
-'447b)- 

441c 
-447c)- 



Execution 

block 
451 (—457) 



Data-block number 
(8bits) 



Key-data count (kn) 
(8bits) 



Key number 
(8bits) 



en.ce7 
"ion 



Key number 



Key data for data 
block 403 



Encryption presence/ 
absence information 



Instruction codes 



(Offset) 
0x0000 



0x0001 

0x0002 
0x0003 



OxOOOB 
OxOOOC 

OxOOOD 



0x0016 



kn 
sets 



0x0002 
+0x000A X kn 
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FIG. 9 







Conditional branch 
instruction 


Unconditional data-block 
branch instruction 






Unconditional data-block 
branch instruction 






Conditional data-block branch " 
instruction 







( 



( 



Conditional data-block inside/ 
outside branch instruction 



Conditional data-block inside/ 
outside branch instruction 



451 



501 

-^To data block 402 



■502 

502 

^To data block 403 



503 

y^To data block 402 
^^To data block 403 



504 

-^To data block 402 



■504 

->To data block 403 
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FIG. 10 



Start ) 



\/_ 



Single program is divided into seven 
instruction-code groups. 



S301 



> 

Key data 440b through 
401 through 407 


447b for data blocks 
is determined. 






Decryption information 411 through 417 for 
data blocks 401 through 407 is prepared. 



S302 



S303 



Among the branch instructions included in 
each instruction-code group, branch 
instructions causing branches to other data 
blocks are replaced with data-block branch 
instructions, thereby generating execution 
blocks 451 through 457. From execution 
blocks 451 through 457 and decryption 
information sets 411 through 417, data blocks 
401 through 407 are created. 



S304 



)k. 

All key information 441 through 447 is 
encrypted with corresponding key data 440b 
through 446b, while among execution blocks 
451 through 457, to-be-protected execution 
blocks 451 and 452 are encrypted with 
corresponding key data 440b and 441b. 



Prepared data blocks 401 through 407 

are stored in memory 120. 



S306 



( Exit ) 
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FIG. 11 



Q Start 3 



Key table 306a retains initial key number 440a, key 
data 440b and selection command inputted from without 
with respect to microcomputer 300. 



CPU 301 puts data-block-number/key-data-count read 
signal to H level. Selection portion 304 switches so 
as to select output from memory 120. 



CPU 301 reads from memory 120 data block number and 
key-data count in decryption information, which are 
inputted into CPU 301 via selection portion 304 as 
they are from memory 120. 



S401 



S402 



S403 



CPU 301 outputs data block number. Decryption- 
information management portion 306 sets, in key-data 
retention portion 103 and selection-command retention 

portion 105, key data and selection command each 
corresponding to the key number that matches with that 
inputted data block number. 



•S404 



CPU 301 puts data-block-number/key-data-count read 
signal to L level, while putting key-information read 
signal to H level. Selection portion 304 switches so 
as to select output from decryption portion 102. 



S405 



Via decryption portion 102, CPU 301 successively reads 
from memory 120 that number of key information sets 
that corresponds to the number of key data sets, and 
then outputs the key information sets to decryption- 
information management portion 306 for retention by 



key tab 



e 306a. 



S406 



CPU 301 puts key-information read signal to L level. 

Selection portion 304 switches so as to select output 
either from decryption portion 102 or memory 120 
according to selection command set in selection- 

command retention portion 105. 



M/ 



CPU 301 reads instruction code directly from memory 
120 or via decryption portion 102. 



S410 




•S407 



S408 



Yes 



S409 



CPU 301 executes the instruction of 
read instruction code. 
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FIG. 12 



Data 



blocks 701 through 703 to be 
stored in memory 120 



Data 

block ■( 

701 



Decryption 
informatiorT 

7ir 



Execution 
block 

721 



721a- 



230 



Decryption 
informatiorT 

712' 



Data 
blocks 
702 



Execution 
block 

722 



722a- 



230 



Decryption 
informatiorT 

713' 



Data 
block •{ 

703 



Execution 
block 

723 



723a^ 



230 



Decryption information that is key data 
711 for decrypting execution block 721, 
encrypted with common key data 740. 



Instruction codes 



Execution completion code 



Decryption information that is 
dummy key data 710 encrypted with 
common key data 740. 



Instruction codes 



Execution completion code 



Decryption information that is 
dummy key data 710 encrypted with 
common key data 740. 



Instruction codes 



Execution completion code 
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FIG. 14 

( Start ) 



Common key data 7 
decryption inforn 
through 713 " in dat 
703 is de 


40 for decrypting 
aation sets 711 " 
a blocks 701 through 
terrained. 


V 


f 


Single program is divided into three 
instruction-code groups 721a through 

723a. 


N 


f 


Key data 711 for to^be-protected data 
block 701, and dummy key data 710 for 
data blocks 702 and 703 are determined. 






Key data 711 and dummy key data 710 for 
data blocks 701 through 703 are 
encrypted with common key data 740. 


> 





Execution completion code 230 is added 
to instruction-code groups 721a through 
723a to generate execution blocks 721 
through 723. Data blocks 701 through 
703 are prepared from execution blocks 
721 through 723^ and decryption 
information 711 " through 713 " . 



N 


f 


Among execution blocks 721 through 723, 
to-be-protected execution block 721 is 
encrypted with key data 711. 




f 


Prepared data blocks 701 through 703 
are stored in memory 120. 



S501 



•S502 



S503 



S504 



S505 



■S506 



■S507 



( Exit ) 
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FIG. 15 

( Start ) 



Common key data 740 and dummy key data 710 inputted from 
without with respect to microcomputer 600 are retained 
in common-key-data retaining portion 606b and 
comparison-data retaining portion 606d. 



CPU 601 puts decryption-information read signal to H 
level. Selection portion 604 switches so as to select 
output from memory 120. 



\/_ 



CPU 601 reads decryption information from memory 120. 
(Via selection portion 604, the decryption information 
is inputted as it is from memory 120 into CPU 601. ) 



\1/ 



CPU 601 outputs the read decryption information as it is 
into key-data decryption potion 606a in decryption- 
information management portion 606. 



Key-data decryption potion 606a decrypts decryption 
information using common key data 740, and outputs key 

data 711 or dummy key data 710 for retention by key-data 
retention portion 103, while outputting that key data 
711 or that dummy key data 710 to encryption presence/ 

absence determining portion 606c. 



Encryption presence/absence determining portion 606c 
compares output from key-data decryption potion 606a 
with dummy key data 710 retained in comparison-data 
retaining portion 606d, and makes selection-command 
retention portion 105 retain selection command. 



CPU 601 puts decrypt ion- information read signal to L 
level. Selection portion 604 switches so as to select 
either output from memory 120 or decryption portion 102 
according to selection command set in selection-command 
retention portion 105. 



CPU 601 reads instruction code directly from 
memory 120 or via decryption portion 102. 




S601 



S602 



S603 



S604 



S605 



S606 



S607 



•S608 



Yes 



CPU 601 executes the instruction 
of read instruction code. 
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